Jenkins vulnerabilities
The newest vulnerabilities affecting Jenkins, up to 200. Subscribe by RSS.
- CVE-2026-117626Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspJenkins Project Jenkins
- CVE-2026-117625A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain theJenkins Project Jenkins
- CVE-2026-117624Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked asJenkins Project Jenkins
- CVE-2026-117623Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, rJenkins Project Jenkins
- CVE-2026-117622Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the cJenkins Project Jenkins
- CVE-2026-117621Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file anJenkins Project Jenkins
- CVE-2026-117620Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old DataJenkins Project Jenkins
- CVE-2026-117619Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API tokeJenkins Project Jenkins
- CVE-2026-117618In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setuJenkins Project Jenkins
- CVE-2026-117617Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parenJenkins Project Jenkins
- CVE-2026-117616Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowingJenkins Project Jenkins
- CVE-2026-117615Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attaJenkins Project Jenkins
- CVE-2026-117614Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by theJenkins Project Jenkins
- CVE-2026-117613Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers witJenkins Project Jenkins
- CVE-2026-117612Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attrJenkins Project Jenkins
- CVE-2026-92141Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishJenkins Project Jenkins Keycloak Authentication Plugin
- CVE-2026-92140Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resultJenkins Project Jenkins Gitee Plugin
- CVE-2026-92139Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…
- CVE-2026-92138The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_callback` URL from the suJenkins Project Jenkins Bitbucket Server Integration Plugin
- CVE-2026-92137Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is coJenkins Project Jenkins Robot Framework Plugin
- CVE-2026-92136Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultinJenkins Project Jenkins OWASP Dependency-Check Plugin
- CVE-2026-92135Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thrJenkins Project Jenkins Coverage Plugin
- CVE-2026-92134Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitteJenkins Project Jenkins Warnings Plugin
- CVE-2026-92133Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials undeJenkins Project Jenkins GitLab Plugin
- CVE-2026-92132Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, eveJenkins Project Jenkins Gradle Plugin
- CVE-2026-92131Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library PipelineJenkins Project Jenkins Pipeline: Groovy Libraries Plugin
- CVE-2026-92130Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolJenkins Project Jenkins Pipeline: Multibranch Plugin
- CVE-2026-92129Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically toJenkins Project Jenkins Script Security Plugin
- CVE-2026-92128Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of theJenkins Project Jenkins Script Security Plugin
- CVE-2026-92127Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when Jenkins Project Jenkins Script Security Plugin
- CVE-2026-92126Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an Jenkins Project Jenkins Script Security Plugin
- CVE-2026-92125Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attaJenkins Project Jenkins Script Security Plugin
- CVE-2026-92124Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from aJenkins Project Jenkins Script Security Plugin
- CVE-2026-92123Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, pJenkins Project Jenkins Script Security Plugin
- CVE-2026-92122Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxedJenkins Project Jenkins Script Security Plugin
- CVE-2026-84677Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugiJenkins Project Jenkins update-center2
- CVE-2026-84676Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller whJenkins Project Jenkins Parameterized Remote Trigger Plugin
- CVE-2026-84675OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable vJenkins Project Jenkins TICS Plugin
- CVE-2026-84674Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerateJenkins Project Jenkins XebiaLabs XL Deploy Plugin
- CVE-2026-84673Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through StaplerJenkins Project Jenkins Customizable Header Plugin
- CVE-2026-84672Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group'sJenkins Project Jenkins Microsoft Entra ID (previously Azur…
- CVE-2026-84671Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sysJenkins Project Jenkins File Parameter Plugin
- CVE-2026-84670Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cachedJenkins Project Jenkins Performance Plugin
- CVE-2026-84669A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish AJenkins Project Jenkins Allure Plugin
- CVE-2026-84668Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindiJenkins Project Jenkins SAML Plugin
- CVE-2026-84667Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attaJenkins Project Jenkins ThinBackup Plugin
- CVE-2026-84666Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration thJenkins Project Jenkins Job Configuration History Plugin
- CVE-2026-84665Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scannerJenkins Project Jenkins SonarQube Scanner Plugin
- CVE-2026-84664Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowinJenkins Project Jenkins GitLab Plugin
- CVE-2026-84663A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackerJenkins Project Jenkins Pipeline: Groovy Libraries Plugin
- CVE-2026-84662Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackersJenkins Project Jenkins LDAP Plugin
- CVE-2026-84661A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `Jenkins Project Jenkins Pipeline: Build Step Plugin
- CVE-2026-84660A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by theJenkins Project Jenkins Pipeline: Build Step Plugin
- CVE-2026-84659Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force thJenkins Project Jenkins Script Security Plugin
- CVE-2026-84658Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads scripJenkins Project Jenkins Script Security Plugin
- CVE-2026-84657In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flaJenkins Project Jenkins
- CVE-2026-84656A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one Jenkins Project Jenkins
- CVE-2026-84655Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST APIJenkins Project Jenkins
- CVE-2026-84654In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,Jenkins Project Jenkins
- CVE-2026-84653Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in tJenkins Project Jenkins
- CVE-2026-84652In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember meJenkins Project Jenkins
- CVE-2026-84651In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submJenkins Project Jenkins
- CVE-2026-84650In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to Jenkins Project Jenkins
- CVE-2026-84649In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 thJenkins Project Jenkins
- CVE-2026-84648In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestaJenkins Project Jenkins
- CVE-2026-84647In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,Jenkins Project Jenkins
- CVE-2026-84646In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allJenkins Project Jenkins
- CVE-2026-84645In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confiJenkins Project Jenkins
- CVE-2026-70448Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing IvyJenkins Project Jenkins Ivy Report Plugin
- CVE-2026-70447Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentJenkins Project Jenkins AWS CodeBuild Plugin
- CVE-2026-70446Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentialJenkins Project Jenkins CodeSonar Plugin
- CVE-2026-70445Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credeJenkins Project Jenkins Sauce OnDemand Plugin
- CVE-2026-70444A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission tJenkins Project Jenkins Violation Comments to GitLab Plugin
- CVE-2026-70443Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackerJenkins Project Jenkins Horreum Plugin
- CVE-2026-70442Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowingJenkins Project Jenkins Google Chat Notification Plugin
- CVE-2026-70441Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a sJenkins Project Jenkins Summary Display Plugin
- CVE-2026-70440Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context,Jenkins Project Jenkins Qualys Container Scanning Connector…
- CVE-2026-70439Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions Jenkins Project Jenkins XML Job to Job DSL Plugin
- CVE-2026-70438A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins Parameterized Remote Trigger Plugin
- CVE-2026-70437Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checkJenkins Project Jenkins Webhook Secret Credentials Provider…
- CVE-2026-70436Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper Jenkins Project Jenkins External Workspace Manager Plugin
- CVE-2026-70435A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an aJenkins Project Jenkins SCM-Manager Plugin
- CVE-2026-70434A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attackeJenkins Project Jenkins SCM-Manager Plugin
- CVE-2026-70433Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentiJenkins Project Jenkins HCL AppScan Plugin
- CVE-2026-70432A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbJenkins Project Jenkins Multijob Plugin
- CVE-2026-70431Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integrate with Script Security PluginJenkins Project Jenkins Multijob Plugin
- CVE-2026-70430Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naJenkins Project Jenkins
- CVE-2026-70429Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeJenkins Project Jenkins
- CVE-2026-70428Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowJenkins Project Jenkins
- CVE-2026-70427Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction Jenkins Project Jenkins
- CVE-2026-70426In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, Jenkins Project Jenkins · Jenkins Project Remoting
- CVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permissionJenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…
- CVE-2026-57306A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to coJenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…
- CVE-2026-57305A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specJenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57304A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attackeJenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57303Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers aJenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57302Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be vJenkins Project Jenkins FitNesse Plugin · org.jenkins-ci.pl…
- CVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attaJenkins Project Jenkins OWASP ZAP Plugin · org.jenkins-ci.p…
- CVE-2026-57300A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…
- CVE-2026-57299Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permJenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57298A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackeJenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57297A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read peJenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57296Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided tJenkins Project Jenkins External Workspace Manager Plugin ·…
- CVE-2026-57295A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to conneJenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…
- CVE-2026-57294A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…
- CVE-2026-57293An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permissiJenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57292A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to aJenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57291Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57290A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwJenkins Project Jenkins Priority Sorter Plugin · org.jenkin…
- CVE-2026-57289Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for coJenkins Project Jenkins Bitbucket Push and Pull Request Plu…
- CVE-2026-57288Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativJenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-57287Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying hiJenkins Project Jenkins Job Configuration History Plugin ·…
- CVE-2026-57286A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtaJenkins Project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2026-57285A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read perJenkins Project Jenkins GitHub Branch Source Plugin · org.j…
- CVE-2026-57284Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniJenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…
- CVE-2026-57283A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instJenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…
- CVE-2026-57282Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2026-57281Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions mJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2026-57280Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed foJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2026-53442Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job confJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53441Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53440Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" securityJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53439Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine otJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53438A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking IJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53437Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53436Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-53435In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in JJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-10276hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgeryhekmon8 Jenkins-server-mcp
- CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failJenkins Project Jenkins Multijob Plugin · org.jenkins-ci.pl…
- CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityJenkins Project Jenkins buildgraph-view Plugin · org.jenkin…
- CVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OJenkins Project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2026-48925A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trJenkins Project Jenkins GitHub Integration Plugin · org.jen…
- CVE-2026-48924Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacJenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…
- CVE-2026-48923Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackersJenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2026-48922Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aJenkins Project Jenkins Credentials Binding Plugin · org.je…
- CVE-2026-48921Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aJenkins Project Jenkins Pipeline: Groovy Libraries Plugin ·…
- CVE-2026-48920Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlinJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2026-48919Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.Jenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-48918Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.Jenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-48917Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…
- CVE-2026-48916Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…
- CVE-2026-42525Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowiJenkins Project Jenkins Microsoft Entra ID (previously Azur…
- CVE-2026-42524Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2026-42523Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the featuJenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…
- CVE-2026-42522A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permJenkins Project Jenkins GitHub Branch Source Plugin · org.j…
- CVE-2026-42521Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specifiJenkins Project Jenkins Matrix Authorization Strategy Plugi…
- CVE-2026-42520Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing aJenkins Project Jenkins Credentials Binding Plugin · org.je…
- CVE-2026-42519A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission tJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2026-33004Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…
- CVE-2026-33003Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…
- CVE-2026-33002Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made tJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-33001Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-27100Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting the build does not Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-27099Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67643Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workJenkins Project Jenkins Redpen - Pipeline Reporter for Jira…
- CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing aJenkins Project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2025-67641Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage resJenkins Project Jenkins Coverage Plugin · io.jenkins.plugin…
- CVE-2025-67640Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a teJenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2025-67639A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users intoJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67638Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67637Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins contJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67636A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypteJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-67635Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corJenkins Project Jenkins · org.jenkins-ci.main:jenkins-co… +1
- CVE-2025-64150A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect tJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64149A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an aJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64148A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerateJenkins Project Jenkins Publish to Bitbucket Plugin · org.j…
- CVE-2025-64147Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackeJenkins Project Jenkins Curseforge Publisher Plugin · org.j…
- CVE-2025-64146Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewJenkins Project Jenkins Curseforge Publisher Plugin · org.j…
- CVE-2025-64145Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for atJenkins Project Jenkins ByteGuard Build Actions Plugin · io…
- CVE-2025-64144Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can beJenkins Project Jenkins ByteGuard Build Actions Plugin · io…
- CVE-2025-64143Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controllJenkins Project Jenkins OpenShift Pipeline Plugin · com.ope…
- CVE-2025-64142A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect toJenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…
- CVE-2025-64141A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an atJenkins Project Jenkins Nexus Task Runner Plugin · org.jenk…
- CVE-2025-64140Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with IteJenkins Project Jenkins Azure CLI Plugin · org.jenkins-ci.p…
- CVE-2025-64139A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connJenkins Project Jenkins Start Windocks Containers Plugin ·…
- CVE-2025-64138A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect toJenkins Project Jenkins Start Windocks Containers Plugin ·…
- CVE-2025-64137A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attackeJenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…
- CVE-2025-64136A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specJenkins Project Jenkins Themis Plugin · org.jenkins-ci.plug…
- CVE-2025-64135Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` Jenkins Project Jenkins Eggplant Runner Plugin · io.jenkins…
- CVE-2025-64134Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevJenkins Project Jenkins JDepend Plugin · org.jenkins-ci.plu…
- CVE-2025-64133A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackeJenkins Project Jenkins Extensible Choice Parameter Plugin…
- CVE-2025-64132Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trJenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…
- CVE-2025-64131Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about Jenkins Project Jenkins SAML Plugin · org.jenkins-ci.plugin…
- CVE-2025-59476Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified coJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-59475Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu, allJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-59474Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible tJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-58460A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission Jenkins Project Jenkins OpenTelemetry Plugin · io.jenkins.p…
- CVE-2025-58459Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attaJenkins Project Jenkins global-build-stats Plugin · org.jen…
- CVE-2025-58458In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2025-53743Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- CVE-2025-53742Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, Jenkins Project Jenkins Applitools Eyes Plugin · org.jenkin…
- CVE-2025-53678Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins contJenkins Project Jenkins User1st uTester Plugin · io.jenkins…
- CVE-2025-53677Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential forJenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…
- CVE-2025-53676Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controlleJenkins Project Jenkins Xooa Plugin · io.jenkins.plugins:xo…
- CVE-2025-53675Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they Jenkins Project Jenkins Warrior Framework Plugin · org.jenk…
- CVE-2025-53674Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, inJenkins Project Jenkins Sensedia Api Platform tools Plugin…
- CVE-2025-53673Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration filJenkins Project Jenkins Sensedia Api Platform tools Plugin…
- CVE-2025-53672Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controllJenkins Project Jenkins Kryptowire Plugin · io.jenkins.plug…
- CVE-2025-53671Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job confJenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…
- CVE-2025-53670Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml fiJenkins Project Jenkins Nouvola DiveCloud Plugin · org.jenk…